iCagenda extension for Joomla vulnerabilities
4 known vulnerabilities in iCagenda extension for Joomla from Icagenda.com. 4 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.6 High severity
iCagenda extension for Joomla: Improper Neutralization of Input During Web Page Generation
Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the `image` and `file` fields as raw strings with no output-side HTML-attribute escaping.
- 8.6 High severity
iCagenda extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda could inject SQL.
- 9.2 Critical severity
iCagenda extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11 - Unauthenticated SQL injection in mod_icagenda_calendar (iCagenda), reachable via com_ajax with no session, token or account.
- 9.8 Critical severity
iCagenda Unrestricted Upload of File with Dangerous Type Exploited
A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.